| #!/usr/bin/env python |
| # Copyright 2017 The Chromium Authors. All rights reserved. |
| # Use of this source code is governed by a BSD-style license that can be |
| # found in the LICENSE file. |
| """Generate a C++ file containing information on all accepted CT logs.""" |
| |
| import base64 |
| import hashlib |
| import json |
| import math |
| import sys |
| |
| |
| def _write_cpp_header(f): |
| f.write("// This file is auto-generated, DO NOT EDIT.\n\n") |
| |
| |
| def _write_log_info_struct_definition(f): |
| f.write( |
| "struct CTLogInfo {\n" |
| " // The DER-encoded SubjectPublicKeyInfo for the log.\n" |
| " const char* log_key;\n" |
| " // The length, in bytes, of |log_key|.\n" |
| " size_t log_key_length;\n" |
| " // The user-friendly log name.\n" |
| " // Note: This will not be translated.\n" |
| " const char* log_name;\n" |
| " // The HTTPS API endpoint for the log.\n" |
| " // Note: Trailing slashes should be included.\n" |
| " const char* log_url;\n" |
| " // The DNS API endpoint for the log.\n" |
| " // This is used as the parent domain for all queries about the " |
| "log.\n // If empty, CT DNS queries are not supported for the log. " |
| "This will prevent\n // retrieval of inclusion proofs over DNS for " |
| "SCTs from the log.\n" |
| " // https://github.com/google/certificate-transparency-rfcs/blob/" |
| "master/dns/draft-ct-over-dns.md.\n" |
| " const char* log_dns_domain;\n" |
| "};\n\n" |
| ) |
| |
| |
| def _write_disqualified_log_info_struct_definition(f): |
| f.write( |
| "// Information related to previously-qualified, but now disqualified," |
| "\n" |
| "// CT logs.\n" |
| "struct DisqualifiedCTLogInfo {\n" |
| " // The ID of the log (the SHA-256 hash of |log_info.log_key|.\n" |
| " const char log_id[33];\n" |
| " const CTLogInfo log_info;\n" |
| " // The offset from the Unix Epoch of when the log was disqualified." |
| "\n" |
| " // SCTs embedded in pre-certificates after this date should not" |
| " count\n" |
| " // towards any uniqueness/freshness requirements.\n" |
| " const base::TimeDelta disqualification_date;\n" |
| "};\n\n") |
| |
| |
| def _split_and_hexify_binary_data(bin_data): |
| """Pretty-prints, in hex, the given bin_data.""" |
| hex_data = "".join(["\\x%.2x" % ord(c) for c in bin_data]) |
| # line_width % 4 must be 0 to avoid splitting the hex-encoded data |
| # across '\' which will escape the quotation marks. |
| line_width = 68 |
| assert line_width % 4 == 0 |
| num_splits = int(math.ceil(len(hex_data) / float(line_width))) |
| return ['"%s"' % hex_data[i * line_width:(i + 1) * line_width] |
| for i in range(num_splits)] |
| |
| |
| def _get_log_ids_array(log_ids, array_name): |
| num_logs = len(log_ids) |
| log_ids.sort() |
| log_id_length = len(log_ids[0]) + 1 |
| log_id_code = [ |
| "// The list is sorted.\n", |
| "const char %s[][%d] = {\n" % (array_name, log_id_length)] |
| for i in range(num_logs): |
| split_hex_id = _split_and_hexify_binary_data(log_ids[i]) |
| s = " %s" % ("\n ".join(split_hex_id)) |
| if (i < num_logs - 1): |
| s += ',\n' |
| log_id_code.append(s) |
| log_id_code.append('};\n\n') |
| return log_id_code |
| |
| |
| |
| def _find_google_operator_id(json_log_list): |
| goog_operator = [op for op in json_log_list["operators"] |
| if op["name"] == "Google"] |
| if len(goog_operator) != 1: |
| raise RuntimeError("Google operator ID not found.") |
| |
| return goog_operator[0]["id"] |
| |
| |
| def _get_log_ids_for_operator(logs, operator_id): |
| """Returns a list of Log IDs of logs operated by operator_id.""" |
| log_ids = [] |
| for log in logs: |
| # operated_by is a list, in practice we have not witnessed |
| # a log co-operated by more than one operator. Ensure we take this |
| # case into consideration if it ever happens. |
| assert(len(log["operated_by"]) == 1) |
| if operator_id == log["operated_by"][0]: |
| log_key = base64.decodestring(log["key"]) |
| log_ids.append(hashlib.sha256(log_key).digest()) |
| return log_ids |
| |
| |
| def _is_log_disqualified(log): |
| return log.get("disqualified_at") != None |
| |
| |
| def _escape_c_string(s): |
| def _escape_char(c): |
| if 32 <= ord(c) <= 126 and c not in '\\"': |
| return c |
| else: |
| return '\\%03o' % ord(c) |
| return ''.join([_escape_char(c) for c in s]) |
| |
| |
| def _to_loginfo_struct(log): |
| """Converts the given log to a CTLogInfo initialization code.""" |
| log_key = base64.decodestring(log["key"]) |
| split_hex_key = _split_and_hexify_binary_data(log_key) |
| s = " {" |
| s += "\n ".join(split_hex_key) |
| s += ',\n %d' % (len(log_key)) |
| s += ',\n "%s"' % (_escape_c_string(log["description"])) |
| s += ',\n "https://%s"' % (log["url"]) |
| s += ',\n "%s"' % (log["dns_api_endpoint"]) |
| s += '}' |
| return s |
| |
| |
| def _get_log_definitions(logs): |
| """Returns a list of strings, each is a CTLogInfo definition.""" |
| list_code = [] |
| for log in logs: |
| list_code.append(_to_loginfo_struct(log)) |
| return list_code |
| |
| |
| def _to_disqualified_loginfo_struct(log): |
| log_key = base64.decodestring(log["key"]) |
| log_id = hashlib.sha256(log_key).digest() |
| s = " {" |
| s += "\n ".join(_split_and_hexify_binary_data(log_id)) |
| s += ",\n" |
| s += _to_loginfo_struct(log) |
| s += ",\n" |
| s += ' base::TimeDelta::FromSeconds(%d)' % (log["disqualified_at"]) |
| s += '}' |
| return s |
| |
| |
| def _get_disqualified_log_definitions(logs): |
| """Returns a list of DisqualifiedCTLogInfo definitions.""" |
| list_code = [] |
| for log in logs: |
| list_code.append(_to_disqualified_loginfo_struct(log)) |
| return list_code |
| |
| |
| def _sorted_disqualified_logs(all_logs): |
| return sorted( |
| filter(_is_log_disqualified, all_logs), |
| key=lambda l: hashlib.sha256( |
| base64.decodestring(l["key"])).digest()) |
| |
| |
| def _write_qualifying_logs_loginfo(f, qualifying_logs): |
| f.write("// The set of all presently-qualifying CT logs.\n" |
| "// Google provides DNS frontends for all of the logs.\n") |
| f.write("const CTLogInfo kCTLogList[] = {\n") |
| f.write(",\n".join(_get_log_definitions(qualifying_logs))) |
| f.write("\n};\n\n") |
| |
| |
| def generate_cpp_file(input_file, f): |
| """Generate a header file of known logs to be included by Chromium.""" |
| json_log_list = json.load(input_file) |
| _write_cpp_header(f) |
| |
| logs = json_log_list["logs"] |
| |
| # Write the list of currently-qualifying logs. |
| qualifying_logs = [log for log in logs if not _is_log_disqualified(log)] |
| _write_log_info_struct_definition(f) |
| _write_qualifying_logs_loginfo(f, qualifying_logs) |
| |
| # Write the IDs of all CT Logs operated by Google |
| google_log_ids = _get_log_ids_for_operator( |
| logs, _find_google_operator_id(json_log_list)) |
| f.writelines(_get_log_ids_array(google_log_ids, 'kGoogleLogIDs')) |
| |
| # Write the list of all disqualified logs. |
| _write_disqualified_log_info_struct_definition(f) |
| f.write("// The set of all disqualified logs, sorted by |log_id|.\n") |
| f.write("constexpr DisqualifiedCTLogInfo kDisqualifiedCTLogList[] = {\n") |
| f.write(",\n".join( |
| _get_disqualified_log_definitions( |
| _sorted_disqualified_logs(logs)))) |
| f.write("\n};\n") |
| |
| |
| def main(): |
| if len(sys.argv) != 3: |
| print('usage: %s in_loglist_json out_header' % sys.argv[0]) |
| return 1 |
| with open(sys.argv[1], 'r') as infile, open(sys.argv[2], 'w') as outfile: |
| generate_cpp_file(infile, outfile) |
| return 0 |
| |
| |
| if __name__ == '__main__': |
| sys.exit(main()) |
